contact: implement honeypot instead of visible robot field

diff --git a/contact.html b/contact.html
index 227a19c..95d1412 100644 (file)
--- a/contact.html
+++ b/contact.html
@@ -14,11 +14,7 @@
                        <div class="field"><input type="text" name="name" value="~name attr~"></div>
 
                        <div class="caption">Email</div>
-                       <div class="field"><input type="email" name="email" value="~email attr~"></div>
-
-                       <div class="caption">Robot Barrier (Required)</div>
-                       <div class="field_notes">Enter (below) the number between ~robot_minus_one~ and ~robot_plus_one~</div>
-                       <div class="field"><input type="text" name="robot" value="~robot attr~"></div>
+                       <div class="field"><input type="hidden" name="fields" value="~robot_field attr~~email_field attr~"><input type="email" name="~robot_field attr~" value=""><input type="email" name="~email_field attr~" value="~email attr~"><script>document.write('<style>input[name="'+document.getElementsByName('fields')[0].value.substr(0, 16)+'"]{display:none}</style>')</script></div>
 
                        <div class="caption">Message</div>
                        <div class="field"><textarea style="box-sizing: border-box; width: 100%; height: 220px" name="comments">~comments html~</textarea></div>

diff --git a/contact.php b/contact.php
index 11d53b2..55077d9 100644 (file)
--- a/contact.php
+++ b/contact.php
@@ -8,21 +8,39 @@
 $GLOBALS['contact_to'] = 'fixme@example.com';
 $GLOBALS['contact_from'] = 'noreply@example.com';
 $GLOBALS['contact_cc'] = '';
-$globals['contact_subject'] = '';
-$GLOBALS['contact_robot_answer'] = 1002;
+$GLOBALS['contact_subject'] = '';
 
 
 require_once(__DIR__.'/'.'inc/wfpl/format.php');
 require_once(__DIR__.'/'.'inc/wfpl/email.php');
 
+# generate a new random 16-character string
+function contact_new_field_key() {
+       $character_set = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+       $id = "                ";
+
+       # PHP 4.2.0 and up seed the random number generator for you.
+       # Lets hope that it seeds with something harder to guess than the clock.
+       for($i = 0; $i < 16; ++$i) {
+               $id{$i} = $character_set{mt_rand(0, 61)};
+       }
+
+       return $id;
+}
+
 function contact_get_fields() {
        $data = array();
 
+
        $data['name'] = format_oneline(_REQUEST_cut('name'));
-       $data['email'] = format_email(_REQUEST_cut('email'));
-       $data['robot'] = format_oneline(_REQUEST_cut('robot'));
        $data['comments'] = format_unix(_REQUEST_cut('comments'));
 
+       $fields = _REQUEST_cut('fields');
+       if (preg_match('/^[a-zA-Z0-9]{32}$/', $fields)) {
+               $data['robot'] = format_oneline(_REQUEST_cut(substr($fields, 0, 16)));
+               $data['email'] = format_email(_REQUEST_cut(substr($fields, 16)));
+       }
+
        return $data;
 }
 
@@ -32,22 +50,22 @@ function contact_main() {
 }
 
 function contact_main_form() {
-       $robot_correct = "" . $GLOBALS['contact_robot_answer'];
-       $robot_minus_one = "" . ($GLOBALS['contact_robot_answer'] - 1);
-       $robot_plus_one = "" . ($GLOBALS['contact_robot_answer'] + 1);
-       tem_set('robot_minus_one', $robot_minus_one);
-       tem_set('robot_plus_one', $robot_plus_one);
-
        if (isset($_POST['name'])) {
                $data = contact_get_fields();
                $host = this_host();
 
+               # gj robot, you did it ;)
+               if ($data['robot'] !== '') {
+                       return './contact_thanks';
+               }
+
                if (!$data['name'] && !$data['email'] && !$data['comments']) {
                        // message("you didn't fill anything out")
-               } elseif ($data['robot'] !== $robot_correct) {
-                       message("Please type $robot_correct into the Robot Barrier field");
+               } elseif (!$data['email']) {
+                       message("Error: Please fill out the email field.");
                } else {
-                       if ($GLOBALS['contact_to'] != 'fixme@example.com') {
+                       $error = false;
+                       if ($data['robot'] === '' && $GLOBALS['contact_to'] != 'fixme@example.com') {
                                $to = $GLOBALS['contact_to'];
                                if ($GLOBALS['contact_from'] === '') {
                                        $from = "$host/contact <noreply@$host>";
@@ -57,7 +75,7 @@ function contact_main_form() {
                                $reply_to = $to;
                                if (isset($data['email']) and valid_email($data['email'])) {
                                        $reply_to = $data['email'];
-                                       if ($data['name'] and ereg('^[a-zA-Z0-9_\' -]*$', $data['name']) !== false) {
+                                       if ($data['name'] and preg_match('/^[a-zA-Z0-9_\'. -]*$/', $data['name']) !== false) {
                                                $reply_to = "$data[name] <$reply_to>";
                                        }
                                }
@@ -95,5 +113,8 @@ function contact_main_form() {
                $data = array();
        }
 
+       $data['robot_field'] = contact_new_field_key();
+       $data['email_field'] = contact_new_field_key();
+
        tem_set('form', $data);
 }

diff --git a/inc/wfpl b/inc/wfpl
index 5b22312..ebd28f9 160000 (submodule)
--- a/inc/wfpl
+++ b/inc/wfpl
@@ -1 +1 @@
-Subproject commit 5b223129ade45127f3945a354f8b2a56799f472c
+Subproject commit ebd28f9548c9723fab12e3cb725db9a3b1530992